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Abstract 

Several quantum cryptosystems utilizing different kinds of nonclassical lights are de- 
scribed which can accommodate high intensity fields and high data rate. However, they are 
all sensitive to loss and both the high rate and the strong-signal character rapidly disappear. 

A squeezed light homodyne detection scheme is proposed which, with present-day technol- 
ogy, leads to more than two orders of magnitude data rate improvement over other current 
experimental systems for moderate loss. 

The following is the second half of my talk “Squeezing, vacuum fluctuation, and all that” 
given at the Fourth International Conference on Squeezed States and Uncertainty Relations held 
in Taiyuan, China, June 1995. The first half consists of a brief review of sqeezing, a discussion 
of its coherence properties, the reality of vacuum fluctuation, and a treatment of the photon 
localization problem. At least two of these topics require a quantum field treatment that I cannot 
go into here, so I will just concentrate on quantum cryptography. 

Quantum cryptography [1] -[7] is a very interesting and novel approach to secure communi- 
cation with eigenstates of noncommuting observables as carriers of information to assure secrecy. 
In all the concrete optical realizations of such systems which have been studied theoretically or 
experimentally so far [2] -[7], either single-photon eigenstates orweak coherent states with less 
than one average photon per mode are employed to provide security [8]. Such systems not only 
face serious practical limitations in their detection, they are also inherently data-rate limited, 
especially after large transmission attenuation in possible applications such as the INTERNET. 
However, from an abstract point of view, two sets of states having the same linear geometry in the 
Hilbert space of states have the same security in principle. Thus, it is quite possible to describe 
strong-signal quantum cryptosystems, i.e., systems with quantum states that are macroscopically 
distinguishable , which are as secure as the ones that have been proposed. In the following we will 
describe several such systems involving nonclassical lights [9]. Unfortunately, such equivalent sets 
of states behave very differently in loss depending on the field intensity. In all the following sys- 
tems, one cannot maintain either the strong-signal or the high-rate characteristics in the presence 
of the usual linear loss. Although a general proof is not yet available, the evidence indicates that 
there is no strong-signal quantum cryptosystem that would function properly in loss, for the same 
kind of reasons as the difficulties in generating and observing macroscopic superpositions of quan- 
tum states. This feature also leads to serious obstacles in transmitting more than | bit per mode 
securely, although it is not clear what the fundamental rate limit is. As a small compensation, a 
currently implementable system is proposed which may be of practical importance. 
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Consider the following standard quantum cryptosystem [2] with a single polarized photon in 
four different possible polarization states. 


| 1 >l| 0 >2, | 0 >i| 1 >2 (1) 

^(1 1 >i|0>2± | 0 >i| 1 > 2 ) (2) 

where | 1 >i is the photon number = 1 eigenstate of a vertically polarized light mode, | 0 >2 
the vacuum state of the horizontally polarized light mode, so that the two states of (2) are the 
single photon eigenstates of the corresponding diagonally polarized light modes. A sender, Adam, 
picks the basis (1) or (2) at random for transmitting a single bit to the legitimate user, Babe, 
who would choose to measure (1) or (2) also randomly. After comparison in another public 
channel to match basis, they would succeed in communicating on the average | bit per use. 
An eavesdropper, Eve, cannot duplicate a copy of the transmitted state and wait for the public 
measurement announcement, because the four possible states in (1) and (2) are nonorthogonal 
[10]. Similarly, Eve cannot use a quantum measurement to determine without large error which 
state was transmitted; thus any state she re-sends after measurement would induce large error 
in the otherwise perfect bit correlations between Adam and Babe, who could therefore detect 
the eavesdropping via various public forms of comparison. Apart from the practical difficulty of 
generating and detecting single photons, the data rate of this system is reduced to ^ after suffering 
an energy loss 1—7 / due to transmission attenuation, detection quantum efficiency, and whatever. 
If the optical system has bandwidth W , i.e., a total number of W adjacent frequency modes per 
polarization per second, the data rate becomes ^ bits per second assuming perfect detection. In 
the coherent-state realizations of this scheme with energy S < 1, the data rate is further reduced 
to r)SW/ 2. Because of the smallness of this rate in practice, especially when the loss is large, it is 
important to investigate the possibility of rate increase for a single mode. 

Clearly, the state vectors 


I >\\<t> >2, 


>i| ^ > 2 ; -4= (I V> >i| <t> >2 ± I <l> >il 0 


( 3 ) 


where < xp \ <fi >= 0 in each mode 1 and 2 have the same Hilbert space geometry as (l)-(2) in the 
sense of equal inner products, and hence the same security in principle. A strong-signal scheme can 
be obtained, say, by using photon number eigenstates | xp >=| n >, | <f> >=| 0 > or more generally 
| x p >= | ni >, \ <p > = | n 2 > with (rti — n 2 ) >> 1 for macroscopic distinguishability. Note that 
(I n >i | 0 >2 ± | 0 >| n > 2 ) are not the number eigenstates of the diagonally polarized light for 
n > 1. In a single pair of modes, one can increase the data rate by utilizing | xp n >= | n + An > 
, | <f> n >=| n > while keeping An >> 1. IfA r >>lis the upper bound on the photon numbers 
that can be used in a mode, such a scheme would have a data rate of y/oj 2 (1 + N — An) bits 
per second. Such high rate can also be obtained for a lossless system via conjugate coding [1], 
in which the first basis contains N orthogonal states and each state in the second basis is some 
linear combination of all the N states in the first. While it is possible to suggest concrete optical 
realizations for certain number state superpositions, it is not clear how the N-state superpositions 
in conjugate coding may be generated. In any case, all such superpositions degenerate quickly in 
loss as presently demonstrated. 
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It is well known [11]-[12] that linear combinations of macroscopically distinguishable coherent 
states are very sensistive to loss: they degenerate into a mixture of the states very readily. In a 
way, number states fare even worse. In the present context, this means the cryptosystem would 
be incapacitated entirely as the second basis degenerates into the first. Let the lossy system be 
represented by [13]- [14] 

b = ijia + (1 — i j) 1 c (4) 

where c is the photon annihilation operator of a vacuum mode, a and b the input and output 
mode operators. For a pair of independent modes suffering the same loss 1 — rj, each would be 
represented by (4) with different a,b,c . For | ip > = | n >, | (f> > = | 0 >, the difference A p between 
the two density operators resulting from passing the two superposed states of (3) through (4) can 
be conveniently calculated via eqns (6)-(7) of ref [15], with the result 

Ap - V n (I n >i| 0 >2 1 < 0 I 2 < n I + | o >i| n > 2 i < n | 2 < 0 |) (5) 


which goes to zero exponentially in rj. If | ip >=| n x >, | <j> > = | n 2 > in (3), a similar but more 
complicated result is obtained with the eigenvalues of A p - ±2 r] ni+n2 . For the single- mode system 


| Hi >, | U 2 ^ i 


rii > i | n 2 >) 


( 6 ) 


the eigenvalues of the superposed state difference A p in loss are ±yd 7 ni+n2 . Since two equiprobable 
states can only be discriminated with probability equal to the positive eigenvalue of A p from 
quantum detection theory [16], such superposed number state schemes are useless with even a 
tiny amount of loss. 

The coherent-state superpositions in the following 4-state scheme 

(| Q > ± 1 — Q >) ^ 

\/2 [1 ± exp (-2 | a | 2 )] 

can, at least in principle, be obtained from a Kerr medium [17]. For large |a|,< a | —a > = 
exp (—2 | a | 2 ) is nearly zero and the states (7) would perform in practice like an orthogonal 
scheme such as (6). For the general coherent-state superpositions in the following scheme 


| Q >, | -Q >, 


I >, | a 2 > ; jV± (| a x > ± | a 2 >) 


( 8 ) 


where Af± are normalization factors, the resulting density operator difference A p in loss is 
proportional to < y/1 — rj cti \ \/\ — t^o 2 > which goes to zero exponentially in 
(1 — T))* | a x — a 2 |. To avoid this sensitivity to loss, jor x — a 2 | has to be chosen small and 
the resulting data rate for (7) or (8) would be comparable to coherent-state sysytems such as 
{|±a >} or {|±a >; |±ia >}, although (7) or (8) may be more secure because of their similarity to 
the single-photon scheme [7]. If one increases the rate in such systems by displacing the amplitude 
with (m ± m)a 0 for integers m,n and a real o-o with rjatl > 10 to assure near orthogonality 
of the displaced states, which can be readily accomplished experimentally, the resulting rate is 
increased to ~ for large available energy S >> a„. However, Eve can split off a small 

fraction of the signal and determine m,n fairly closely, thus obtaining many bits of information 
probabilistically so that such systems do not truly have a high secure rate. 
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Consider the following 4-state cryptosystem with two 2-state bases given by two-photon co- 
herent states (TCS) [13] or pure squeezed coherent states which can readily be generated over a 
considerable range of parameters [18], 

\n, i / ; ±a > ; | /*, -v; ±ia > (9) 

where | > is the | /?;//, v > of ref [13] with mean field o = /i*/? — i//?* and /z,i/, a are 

all chosen real. In (9), the signal is in the small noise quadrature. As an approximate form of 
conjugate coding for the two conjugate field quadrature operators whose eigenstates have infinite 
energy, consider the extension of (9) to the scheme 


\n, v ; ±ma > ; \fi, -v ; ±ima >, m = 1,3,5, ••• (10) 

From eqn (3.25) of ref [13], | < /x, v\ ±a \ (i, -v\ ±/3 > | 2 = exp(-|a - /? 1 2 ) and 

\ < (i, w, ma | n, -v\ nia > | 2 = (/i 2 + i/ 2 ) -1 exp{-(n 2 + m 2 )a 2 /(/z 2 + t/ 2 )} (11) 

Thus (fi 2 -I- i/ 2 ) cannot be too large from (11), and a also cannot be too large or else Eve can 
determine the state by a phase insensitive linear amplifier followed with beamsplitting or by 
heterodyne detection with the following signal-to-noise ratio in the quadrature containing the 
signal [19] 

SNRl ‘« = T TTT5 (12) 

vit 1 ~ v ) 2 + 2 — 7/ 

In general, one has to assume that Eve may tap at ?/ = 1. 

When the correct quadrature is detected with homodyne detection, the signal-to-noise ratio is 
[13], [19] 

SNR km = (13) 

One must also require that at 77 = 1 , the homodyne SNR obtained by Eve with a beamsplitter 
of transmittance e is sufficiently small so that she cannot quite resolve the state even after the 
measurement announcement with a probability larger than, say, Pj? = 0.25, while the induced 
reduction in the SNRh om for Babe from (13) to 


a at pB _ 4(1 ^)yOi 

hom 9(1 -e)(ft-v) 2 T €t} + (1-r/) 


(14) 


is already sufficiently large that Babe can detect the eavesdropping from the increase in her error 
rate. However, even for small e Eve can locate to within a few states among one basis of (10) quite 
well, unless a is so small that the data rate is strongly affected. Thus, a large number of secure 
bits cannot be derived from the use of (10). Nevertheless the potential of homodyne systems can 
be seen from the following two examples. 

Consider (9) with a 2 = 0.8, u = 0, i] = 1. The homodyne detection probability of error [19] 
is P e = er f c(\J S N R) ~ 0.037. If Eve tries to resolve the four states with optimized heterodyne 
detection, it is readily shown from classsical detection theory that the resulting error probability 
is > 0.2 which is easily detected by Babe. Amplification and beamsplitting would lower Babe’s 
SNR too much at the present signal level. If Eve taps off just a fraction ~ 0.089 of the field 
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to wait for measurement announcement so that the resulting optimum quantum receiver [16] for 
binaray coherent states yields an error probability of 0.25, that would already change Babe’s error 
rate to 0.044 via (10), a 25% increase. With 10 4 transmissions, this means an increase of 3.64 
standard deviations of error in an asymptotic standard Gaussian distrubution , which occurs with 
only a probability ~ 10 -4 . Comparing to the photon detection system [5], [6] with a 2 ~ 0.1 
and considering the fact that close to an order of magnitude improvement in the photodetector 
quantum efficiency can be obtained from high efficiency photodiode for homodyme detection, this 
yields almost two orders of magnitude improvement in the data rate. For the TCS system (10) 
with m = ±1,±3, ct 2 = 1, (/i + v) 2 — 4, 7] = 0.5, and with the homodyne error probability 
among the four states in one basis still given by P e = erfc{\/SNR ), Eve cannot exclude the 
possibility of any state with e = 0.04 which already induces a 3-standard deviation difference in 
Babe’s error rate for 10 4 transmissions, and e = 0.1 is required for Pf = 0.25. The data rate 
is now increased by a factor of ~ 400. The disadvantage of these schemes is that by raising 
the signal level, the initial beamsplitter attack puts a limit on the transmittance r] below which 
the eavesdroppping cannot be detected. This can be amended by setting the threshold of the 
binary decision at a higher level and making no decision below it, which of course reduces the 
data rate, or by decreasing a which would also lower the data rate. Apart from the sensitivity 
of homodyne detection versus photon counting technology, part of the above improvement is due 
to more elaborate signal processing which can also be adopted in photon counting systems. Note 
that as in the direct detection case, the presence of a small error probability for Babe would reduce 
the information rate from the original data rate by a small fraction. Also, Eve could obtain some 
probabilistic information without being detected, which can be eliminated by Babe via ’’privacy 
amplification” [5] that would further lower the information rate. However, for sufficiently long 
keys there is no need to eliminate Eve’s probabilistic information. A detailed study of the various 
possibilities will be given elsewhere. 
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